@agent-cards/sdk 0.23.3 → 0.23.5

package/dist/substitutions.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 6209fa4a22c349d03eed24ea4ff9e626334c5975ec515a4b7f6a83592343274f
+// artifact-sha256: a1b7d280655947da8bb1d465d17c3436504ee350dd0be7f345d524eea0f2f374
 // src/adyen-jwe.js
 var ADYEN_JWE_HEADER = { alg: "RSA-OAEP-256", enc: "A256GCM", version: "1" };
 var BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -277,6 +277,118 @@ function merchantBodyAmountPaths(profile) {
     return isPlainObject(amount) ? [amount.value, amount.currency].filter(Array.isArray) : [];
 }
 // src/merchant-profiles.js
+var DSG_PAYGATE_V2 = /* @__PURE__ */ deepFreeze({
+    method: "POST",
+    path: "/prod/api/paygate/v2/authorization",
+    query: {},
+    // The page sends true for every checkout its translator read, the only checkouts
+    // the amount source below maps; a legacy checkout is not this card request.
+    requires: [{ path: ["isModernOrder"], equals: true }],
+    holder: ["tenders", "encryptedCardTenders", 0],
+    fields: {
+        encryptedCardNumber: "cardNumber",
+        encryptedExpiryMonth: "expirationMonth",
+        encryptedExpiryYear: "expirationYear",
+        encryptedSecurityCode: "cvv"
+    },
+    // cardType and vinBalue describe the dummy the agent typed: the facts below
+    // write the approved card's instead, so nothing is removed.
+    remove: [],
+    refuse: [
+        { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
+        // A saved card, or a second card tender the Vault never encrypted.
+        { path: ["tenders", "savedCardTender"], when: "present" },
+        { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
+        // A gift card pays part of the order, so the card pays less than the total.
+        { path: ["tenders", "giftCardTenders"], when: "present" }
+    ],
+    amount: null,
+    // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
+    // on the checkout page answers the whole checkout, camelCase on the wire: the page
+    // load's PATCH (or the create), then every address, shipping, promotion, gift card,
+    // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
+    // with exactly two decimals ("123.45"; the page itself drops the dot for minor
+    // units). transactionReference is the checkout key, in the body and the URL. After
+    // payment the order submit and the confirmation read return the placed checkout.
+    amountSource: {
+        id: "dsg_checkout_pricing",
+        origin: "checkout",
+        format: "json",
+        responses: [
+            { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+            { method: "POST", path: "/api/v1/checkouts", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
+            { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
+            { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
+            { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
+            { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
+        ],
+        total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
+        unit: "major",
+        currency: "USD",
+        currencyPath: ["pricing", "currency"],
+        bind: [
+            { source: ["checkoutKey"], card: ["transactionReference"] },
+            { placeholder: "checkoutKey", card: ["transactionReference"] }
+        ],
+        // The order total and the card's share are the same text. Anything that lowers the
+        // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
+        // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
+        // the approved amount and the placed checkout's total read after payment agree.
+        requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
+        refuse: [
+            // A placed checkout is not the one being paid.
+            { path: ["orderPlacedTime"], when: "true" },
+            // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
+            { path: ["payment", "giftCards"], when: "nonEmpty" },
+            { path: ["addresses"], when: "empty" }
+        ],
+        maxAgeMs: 9e5,
+        afterPayment: {
+            origin: "checkout",
+            format: "json",
+            responses: [
+                { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
+                { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
+            ],
+            // The order total, which the requires rule above held equal to the card's share
+            // before payment. totalRemaining is not read here: after placement it can drop to
+            // what is still unpaid, which would hide a higher charge.
+            total: { path: ["pricing", "total"], format: "decimal2" },
+            unit: "major",
+            currency: "USD",
+            currencyPath: ["pricing", "currency"],
+            bind: [
+                { source: ["checkoutKey"], card: ["transactionReference"] },
+                { placeholder: "checkoutKey", card: ["transactionReference"] }
+            ],
+            refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
+        }
+    },
+    facts: [
+        // adyen-web's brand codes, the ones the page's supported list names; Dick's own
+        // private-label (plcc, comc) cards have no Agentcard brand and are refused.
+        {
+            path: ["tenders", "encryptedCardTenders", 0, "cardType"],
+            fact: "brand",
+            map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
+        },
+        { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
+    ],
+    adyen: {
+        environment: "live",
+        clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
+        publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
+    }
+});
+function dsgPaygateProfile(own) {
+    return { ...own, ...DSG_PAYGATE_V2 };
+}
 var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
     {
         // Read Sep 23, 2026. assets.dunelm.com checkout-page bundle: submitPayment
@@ -372,10 +484,13 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
         // client key from the three securedFields iframes on
         // checkoutshopper-live-us.adyen.com (adyen-web 6.x). The request body itself
         // was not captured: the guest email gate stopped the run before Pay. Public
-        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC).
+        // key read from checkoutshopper-live-us.adyen.com on 2026-09-25 (UTC). Enabled
+        // Oct 7, 2026 under D1 (amountSource, above): live checks on Sep 30 and Oct 6
+        // matched its key pin, its card request as the page's script builds it, and its
+        // checkout total.
         id: "cinemark_initiate",
         merchant: "Cinemark",
-        status: "observe",
+        status: "enabled",
         origins: [{ checkout: "https://www.cinemark.com", endpoint: "https://www.cinemark.com" }],
         method: "POST",
         path: "/api/adyen/initiatePayment",
@@ -448,137 +563,29 @@ var MERCHANT_HOSTED_PROFILES = /* @__PURE__ */ deepFreeze([
             publicKeySha256: "9dd5ef549c7454d60ca970ff76c8f4cac36d79f2961e59eca9116791e86cbcc5"
         }
     },
-    {
-        // Read Sep 23, 2026. payments.dickssportinggoods.com/library/dppjs/index-v2.js
-        // (adyen-web 6.39.0): Dd() builds tenders.encryptedCardTenders[0] from the Card
-        // component's four JWEs as cardNumber, expirationMonth, expirationYear and cvv,
-        // beside cardType (adyen-web's first detected brand), saveForLater (the save-card
-        // box) and vinBalue (the six digits onBinValue reports). The page posts it with
-        // transactionReference, customer.device and any giftCardTenders to
-        // <payments host>/prod/api/paygate/v2/authorization, the host picked from the
-        // page's own (Dick's, Golf Galaxy, Public Lands, Going Going Gone). The same slot
-        // carries Afterpay, CashApp and Affirm tenders with literal strings where the JWEs
-        // go, and a saved card goes to tenders.savedCardTender instead. The body names no
-        // amount: the paygate charges the cart it holds for transactionReference.
-        // mountCCForm names the client key and environment 'live'. Public key read from
-        // checkoutshopper-live.adyen.com on 2026-09-25 (UTC).
+    /* @__PURE__ */ dsgPaygateProfile({
+        // Dick's own storefront, the one live checks read on Sep 30 and Oct 6, 2026: its key
+        // pin, its card request as the page's code builds it, its card facts and its checkout
+        // pricing matched DSG_PAYGATE_V2. Enabled Oct 7, 2026 under D1 (amountSource, above).
         id: "dsg_paygate_v2",
         merchant: "Dick's Sporting Goods",
+        status: "enabled",
+        origins: [
+            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" }
+        ]
+    }),
+    /* @__PURE__ */ dsgPaygateProfile({
+        // The same paygate on the three other storefronts its page names. No live check has
+        // read them, so their card requests stay paused and aborted in observe.
+        id: "dsg_other_stores_paygate_v2",
+        merchant: "Golf Galaxy, Public Lands and Going Going Gone",
         status: "observe",
         origins: [
-            { checkout: "https://www.dickssportinggoods.com", endpoint: "https://payments.dickssportinggoods.com" },
             { checkout: "https://www.golfgalaxy.com", endpoint: "https://payments.golfgalaxy.com" },
             { checkout: "https://www.publiclands.com", endpoint: "https://payments.publiclands.com" },
             { checkout: "https://www.goinggoinggone.com", endpoint: "https://payments.goinggoinggone.com" }
-        ],
-        method: "POST",
-        path: "/prod/api/paygate/v2/authorization",
-        query: {},
-        // The page sends true for every checkout its translator read, the only checkouts
-        // the amount source below maps; a legacy checkout is not this card request.
-        requires: [{ path: ["isModernOrder"], equals: true }],
-        holder: ["tenders", "encryptedCardTenders", 0],
-        fields: {
-            encryptedCardNumber: "cardNumber",
-            encryptedExpiryMonth: "expirationMonth",
-            encryptedExpiryYear: "expirationYear",
-            encryptedSecurityCode: "cvv"
-        },
-        // cardType and vinBalue describe the dummy the agent typed: the facts below
-        // write the approved card's instead, so nothing is removed.
-        remove: [],
-        refuse: [
-            { path: ["tenders", "encryptedCardTenders", 0, "saveForLater"], when: "true" },
-            // A saved card, or a second card tender the Vault never encrypted.
-            { path: ["tenders", "savedCardTender"], when: "present" },
-            { path: ["tenders", "encryptedCardTenders", 1], when: "present" },
-            // A gift card pays part of the order, so the card pays less than the total.
-            { path: ["tenders", "giftCardTenders"], when: "present" }
-        ],
-        amount: null,
-        // Read Sep 25, 2026 (research amount_source/dickssportinggoods). Every checkout call
-        // on the checkout page answers the whole checkout, camelCase on the wire: the page
-        // load's PATCH (or the create), then every address, shipping, promotion, gift card,
-        // tip and ScoreCard change. pricing.totalRemaining is what the card pays, a string
-        // with exactly two decimals ("123.45"; the page itself drops the dot for minor
-        // units). transactionReference is the checkout key, in the body and the URL. After
-        // payment the order submit and the confirmation read return the placed checkout.
-        amountSource: {
-            id: "dsg_checkout_pricing",
-            origin: "checkout",
-            format: "json",
-            responses: [
-                { method: "PATCH", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                { method: "POST", path: "/api/v1/checkouts", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/addresses", queries: [{}, { type: "billing" }, { type: "shipping" }] },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/shipping/selected/groups/:groupNumber/mode", query: {} },
-                { method: "PUT", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "DELETE", path: "/api/v2/checkouts/:checkoutKey/promotion/cart", query: {} },
-                { method: "POST", path: "/api/v1/checkouts/:checkoutKey/gift-cards", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/gift-cards/:giftCardIndex", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/tip", query: {} },
-                { method: "PUT", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/scorecard", query: {} },
-                { method: "DELETE", path: "/api/v1/checkouts/:checkoutKey/v2/gifts", query: {} }
-            ],
-            total: { path: ["pricing", "totalRemaining"], format: "decimal2" },
-            unit: "major",
-            currency: "USD",
-            currencyPath: ["pricing", "currency"],
-            bind: [
-                { source: ["checkoutKey"], card: ["transactionReference"] },
-                { placeholder: "checkoutKey", card: ["transactionReference"] }
-            ],
-            // The order total and the card's share are the same text. Anything that lowers the
-            // share below the total (a gift card, ScoreCard rewards) or lands in only one of them
-            // (a tip, a donation) is refused until a HAR shows which one the charge follows, so
-            // the approved amount and the placed checkout's total read after payment agree.
-            requires: [{ path: ["pricing", "total"], equalsPath: ["pricing", "totalRemaining"] }],
-            refuse: [
-                // A placed checkout is not the one being paid.
-                { path: ["orderPlacedTime"], when: "true" },
-                // Gift cards and a checkout with no address yet (tax not estimated) wait for a HAR.
-                { path: ["payment", "giftCards"], when: "nonEmpty" },
-                { path: ["addresses"], when: "empty" }
-            ],
-            maxAgeMs: 9e5,
-            afterPayment: {
-                origin: "checkout",
-                format: "json",
-                responses: [
-                    { method: "POST", path: "/api/v1/checkouts/:checkoutKey", query: {} },
-                    { method: "GET", path: "/api/v1/checkouts/submitted/:checkoutKey", query: {} }
-                ],
-                // The order total, which the requires rule above held equal to the card's share
-                // before payment. totalRemaining is not read here: after placement it can drop to
-                // what is still unpaid, which would hide a higher charge.
-                total: { path: ["pricing", "total"], format: "decimal2" },
-                unit: "major",
-                currency: "USD",
-                currencyPath: ["pricing", "currency"],
-                bind: [
-                    { source: ["checkoutKey"], card: ["transactionReference"] },
-                    { placeholder: "checkoutKey", card: ["transactionReference"] }
-                ],
-                refuse: [{ path: ["orderPlacedTime"], when: "unset" }]
-            }
-        },
-        facts: [
-            // adyen-web's brand codes, the ones the page's supported list names; Dick's own
-            // private-label (plcc, comc) cards have no Agentcard brand and are refused.
-            {
-                path: ["tenders", "encryptedCardTenders", 0, "cardType"],
-                fact: "brand",
-                map: { visa: "visa", mastercard: "mc", amex: "amex", discover: "discover", diners: "diners", jcb: "jcb" }
-            },
-            { path: ["tenders", "encryptedCardTenders", 0, "vinBalue"], fact: "bin6" }
-        ],
-        adyen: {
-            environment: "live",
-            clientKey: "live_YJLFKT47JJG2RI7QIYX6HTKKDEDOEGOH",
-            publicKeySha256: "da33611149dff3ab715be8671c0550bb8aec6112983b2473db9ee7afb829c110"
-        }
-    },
+        ]
+    }),
     {
         // Read Sep 25, 2026, from public code only: the WooCommerce plugin super-payments 1.40.1 and
         // cdn.superpayments.com/js/v2/payment.webcomponents.script.js as it stood on Sep 19.

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "e570ccbce59b77166e6faef140042c068130bfe2cc4355c054e52ea2aed756e2",
+  "catalog_sha256": "a1bfa3f9da2942711afca14cfc7158a49274869c66e685abc0d36839d2e96454",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/sdk",
-  "version": "0.23.3",
+  "version": "0.23.5",
   "description": "Agentcard's SDK: one client, Agentcard, with two modules. checkout pauses a browser purchase and pays it with the person's own card; voice connects a person to your product once and approves a purchase by voice inside it. Card data never enters your process.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core, and the voice streaming door from packages/voice/src/core (the phone package, @agent-cards/voice, ships it to phones); TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && node scripts/generate-voice-stream.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs pre-claim.test.mjs ekashu.test.mjs paypal-hosted-fields.test.mjs cybersource-secure-acceptance.test.mjs autopilot.test.mjs stripe-checkout.test.mjs stripe-setup.test.mjs stripe-legacy-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs merchant-hosted.test.mjs merchant-total.test.mjs sandbox-declaration.test.mjs minimum-delay.test.mjs paysafe.test.mjs payu.test.mjs attachment.test.mjs worker-targets.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs amadeus.test.mjs pelecard.test.mjs aci.test.mjs primer.test.mjs payrails.test.mjs elavon-converge.test.mjs voice.test.mjs agentcard.test.mjs buy.test.mjs readme.test.mjs gmo.test.mjs cybersource-flex.test.mjs juspay-gate.test.mjs card-endpoint.test.mjs card-endpoint-fastspring.test.mjs card-endpoint-navigation.test.mjs merchant-session-probe.test.mjs datatrans.test.mjs authorize-net-dpm.test.mjs creditguard.test.mjs eprotect.test.mjs wspay.test.mjs shiji-sts.test.mjs worldline-mycheckout.test.mjs verifone.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node checkout-com-browser.test.mjs && node paysafe-preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs && node worker-browser.test.mjs && node amadeus-browser.test.mjs && node adyen-merchant-hosted-browser.test.mjs && node adyen-merchant-frames-browser.test.mjs && node fiserv-browser.test.mjs && node gmo-browser.test.mjs && node cybersource-flex-browser.test.mjs && node juspay-browser.test.mjs && node card-endpoint-browser.test.mjs && node datatrans-browser.test.mjs && node authorize-net-dpm-browser.test.mjs && node pelecard-browser.test.mjs && node aci-browser.test.mjs && node creditguard-browser.test.mjs && node primer-browser.test.mjs && node payrails-browser.test.mjs && node elavon-converge-browser.test.mjs && node eprotect-browser.test.mjs && node wspay-browser.test.mjs && node shiji-sts-browser.test.mjs && node worldline-mycheckout-browser.test.mjs && node paypal-hosted-fields-browser.test.mjs && node cybersource-secure-acceptance-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "check:voice-stream": "node scripts/generate-voice-stream.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",